Pulumi 3

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

1prompt
  1. Pulumi 3111 lines · 4.7K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 200
  • 209
  • 250
  • 312
  • 319
  • 362
  • 367
  • 400
  • 426
  • 494
  • 522
  • 532
  • 552
  • 636
  • 653
  • 732
  • 772
  • 798
  • 807
  • 829
  • 862
  • 863
  • 918
  • 1395

Prompt Preview

Apply these rules to Pulumi 3 infrastructure programs, the CLI and matching Node.js, Python, and Go SDKs, and the providers and automation they run. Apply the chosen programming language's and cloud provider's security guidance as well. Pulumi Cloud, ESC, policy packages, provider packages, and the .NET, Java, and YAML SDKs have separate release schedules.

Release and execution trust

  • Follow the newest stable Pulumi 3 release while that line receives security fixes, including the minor releases where Pulumi ships fixes. Constrain the CLI with requiredPulumiVersion, keep language dependencies in a reviewed lock file, audit them in CI, and check the CLI, language runtime, plugins, and worker image separately because a package audit cannot see every executable. Never loosen a constraint just to make an install succeed.
  • Use supported host runtimes that satisfy the selected SDK's package or module metadata. Fix the actual runtime selected by Pulumi.yaml, the worker image, and the language host; do not assume the CLI's version determines the Node.js, Python, Go, .NET, Java, or YAML SDK version.
  • Run pulumi preview, pulumi new, pulumi install, and package installation as code execution. Evaluate untrusted changes in a disposable worker without production cloud credentials, stack secrets, trusted plugin caches, or write access to protected state.
  • Review Pulumi.yaml, stack settings, package source declarations, runtime options, backend URL, and deployment working directory as part of the deployment program. A changed project or stack identity can redirect the